{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T03:15:20.497","vulnerabilities":[{"cve":{"id":"CVE-2021-39179","sourceIdentifier":"security-advisories@github.com","published":"2021-10-29T14:15:07.667","lastModified":"2024-11-21T06:18:48.367","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects the `/api/trackedEntityInstances` and `/api/trackedEntityInstances/query` API endpoints in all DHIS2 versions 2.34, 2.35, and 2.36. It also affects versions 2.32 and 2.33 which have reached _end of support_ - exceptional security updates have been added to the latest *end of support* builds for these versions. Versions 2.31 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user - the vulnerability requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. Security patches are available in DHIS2 versions 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7, and 2.36.4. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the `/api/trackedEntityInstances`, and `/api/trackedEntityInstances/query` endpoints as a temporary workaround while waiting to upgrade."},{"lang":"es","value":"DHIS 2 es un sistema de información para la captura, administración, comprobación, análisis y visualización de datos. Una vulnerabilidad de inyección SQL en el componente Tracker del servidor DHIS2 permite a atacantes remotos autenticados ejecutar comandos SQL arbitrarios por medio de vectores no especificados. Esta vulnerabilidad afecta a los endpoints de la API \"/api/trackedEntityInstances\" y \"/api/trackedEntityInstances/query\" en todas las versiones de DHIS2 2.34, 2.35 y 2.36. También afecta a las versiones 2.32 y 2.33 que han alcanzado el _fin de soporte_ - se han añadido actualizaciones de seguridad excepcionales a las últimas compilaciones de *fin de soporte* para estas versiones. Las versiones 2.31 y anteriores no se ven afectadas. El sistema es vulnerable a los ataques sólo de los usuarios que han iniciado sesión en DHIS2, y no se presenta forma conocida de explotar la vulnerabilidad sin haber iniciado sesión como usuario de DHIS2. La vulnerabilidad no está expuesta a un usuario no malicioso - la vulnerabilidad requiere un ataque consciente para ser explotada. Una explotación con éxito de esta vulnerabilidad podría permitir al usuario malicioso leer, editar y borrar datos en la instancia de DHIS2. No se presentan explotaciones conocidas de las vulnerabilidades de seguridad abordadas por estas versiones de parches. Los parches de seguridad están disponibles en las versiones de DHIS2 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7 y 2.36.4. No se presenta una solución directa conocida para las instancias de DHIS2 que usan la funcionalidad de Tracker, aparte de actualizar el servidor DHIS2 afectado a uno de los parches en los que es corregida esta vulnerabilidad. Para las implementaciones que NO usan la funcionalidad Tracker, puede ser posible bloquear todo el acceso de red a POST a los endpoints \"/api/trackedEntityInstances\", y \"/api/trackedEntityInstances/query\" como una solución temporal mientras se espera para actualizar"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*","versionStartIncluding":"2.32.0","versionEndIncluding":"2.32.7","matchCriteriaId":"6C69E468-A816-400F-8C40-69E776489B03"},{"vulnerable":true,"criteria":"cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*","versionStartIncluding":"2.33.0","versionEndIncluding":"2.33.9","matchCriteriaId":"F1742533-D56B-4B5A-AA9F-A0F32FE93B44"},{"vulnerable":true,"criteria":"cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*","versionStartIncluding":"2.35.0","versionEndExcluding":"2.35.7","matchCriteriaId":"66768511-C108-4F54-AF71-6DCB7FE05954"},{"vulnerable":true,"criteria":"cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*","versionStartIncluding":"2.36.0","versionEndExcluding":"2.36.4","matchCriteriaId":"E4A2BF5E-D50E-4CE5-80C5-0FCF34560D42"}]}]}],"references":[{"url":"https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/dhis2/dhis2-core/pull/8771","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/dhis2/dhis2-core/pull/8771","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}